Merge pull request #890 from docker/dependabot/npm_and_yarn/aws-sdk-dependencies-0da3cd129b

build(deps): bump the aws-sdk-dependencies group with 2 updates

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Stop docker
         run: |
@@ -43,7 +43,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -60,7 +60,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -85,7 +85,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to ACR
         uses: ./
@@ -105,7 +105,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to Docker Hub
         uses: ./
@@ -124,7 +124,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to ECR
         uses: ./
@@ -144,10 +144,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -169,7 +169,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to Public ECR
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -192,10 +192,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -218,7 +218,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -238,7 +238,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to GitLab
         uses: ./
@@ -258,7 +258,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to Google Artifact Registry
         uses: ./
@@ -278,7 +278,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Login to Google Container Registry
         uses: ./
@@ -286,3 +286,73 @@ jobs:
           registry: gcr.io
           username: _json_key
           password: ${{ secrets.GCR_JSON_KEY }}
+
+  registry-auth:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Login to registries
+        uses: ./
+        with:
+          registry-auth: |
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+            - registry: public.ecr.aws
+              username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+              password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            - registry: registry.gitlab.com
+              username: ${{ secrets.GITLAB_USERNAME }}
+              password: ${{ secrets.GITLAB_TOKEN }}
+
+  registry-auth-dup:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Login to registries
+        uses: ./
+        with:
+          registry-auth: |
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+            - registry: public.ecr.aws
+              username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+              password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+
+  registry-auth-exclusive:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Login to registries
+        id: login
+        continue-on-error: true
+        uses: ./
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry-auth: |
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Check
+        run: |
+          if [ "${{ steps.login.outcome }}" != "failure" ] || [ "${{ steps.login.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/pr-assign-author.yml

@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Publish
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -17,15 +17,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Test
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
         with:
+          source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/validate.yml

@@ -15,16 +15,17 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
-        name: Targets matrix
+        name: List targets
-        id: targets
+        id: generate
-        run: |
+        uses: docker/bake-action/subaction/list-targets@v6
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        with:
+          target: validate
 
   validate:
     runs-on: ubuntu-latest
@@ -35,11 +36,8 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
         with:
           targets: ${{ matrix.target }}

.yarnrc.yml

@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
   - code: YN0013
     level: discard
@@ -5,9 +11,7 @@ logFilters:
     level: discard
   - code: YN0076
     level: discard
+  - code: YN0086
+    level: discard
 
 nodeLinker: node-modules
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"

README.md

@@ -24,6 +24,7 @@ ___
   * [OCI Oracle Cloud Infrastructure Registry (OCIR)](#oci-oracle-cloud-infrastructure-registry-ocir)
   * [Quay.io](#quayio)
   * [DigitalOcean](#digitalocean-container-registry)
+  * [Authenticate to multiple registries](#authenticate-to-multiple-registries)
 * [Customizing](#customizing)
   * [inputs](#inputs)
 * [Contributing](#contributing)
@@ -51,7 +52,7 @@ jobs:
         name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
@@ -105,7 +106,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: registry.gitlab.com
-          username: ${{ secrets.GITLAB_USERNAME }}
+          username: ${{ vars.GITLAB_USERNAME }}
           password: ${{ secrets.GITLAB_PASSWORD }}
 ```
 
@@ -136,7 +137,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <registry-name>.azurecr.io
-          username: ${{ secrets.AZURE_CLIENT_ID }}
+          username: ${{ vars.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 
@@ -199,8 +200,7 @@ jobs:
 Use a service account with permission to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
 Download the key for the service account as a JSON file. Save the contents of
 the file [as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
-named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`,
+named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`.
-or `_json_key_base64` if you use a base64-encoded key.
 
 ```yaml
 name: ci
@@ -302,7 +302,7 @@ jobs:
 
 ### AWS Elastic Container Registry (ECR)
 
-Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryPowerUser).
+Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEC2ContainerRegistryPowerUser).
 Download the access keys and save them as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
 in your GitHub repo.
 
@@ -322,7 +322,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          username: ${{ vars.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 ```
 
@@ -345,7 +345,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          username: ${{ vars.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         env:
           AWS_ACCOUNT_IDS: 012345678910,023456789012
@@ -371,7 +371,7 @@ jobs:
         name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: <region>
       -
@@ -406,7 +406,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: public.ecr.aws
-          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          username: ${{ vars.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         env:
           AWS_REGION: <region>
@@ -440,7 +440,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <region>.ocir.io
-          username: ${{ secrets.OCI_USERNAME }}
+          username: ${{ vars.OCI_USERNAME }}
           password: ${{ secrets.OCI_TOKEN }}
 ```
 
@@ -467,7 +467,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
+          username: ${{ vars.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_ROBOT_TOKEN }}
 ```
 
@@ -491,23 +491,90 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: registry.digitalocean.com
-          username: ${{ secrets.DIGITALOCEAN_USERNAME }}
+          username: ${{ vars.DIGITALOCEAN_USERNAME }}
           password: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
 ```
 
+### Authenticate to multiple registries
+
+To authenticate against multiple registries, you can specify the login-action
+step multiple times in your workflow:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+```
+
+You can also use the `registry-auth` input for raw authentication to
+registries, defined as YAML objects. Each object can contain `registry`,
+`username`, `password` and `ecr` keys similar to current inputs:
+
+> [!WARNING]
+> We don't recommend using this method, it's better to use the action multiple
+> times as shown above.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to registries
+        uses: docker/login-action@v3
+        with:
+          registry-auth: |
+            - username: ${{ vars.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+```
+
 ## Customizing
 
 ### inputs
 
 The following inputs can be used as `step.with` keys:
 
-| Name       | Type   | Default | Description                                                                   |
+| Name            | Type   | Default     | Description                                                                   |
-|------------|--------|---------|-------------------------------------------------------------------------------|
+|-----------------|--------|-------------|-------------------------------------------------------------------------------|
-| `registry` | String |         | Server address of Docker registry. If not set then will default to Docker Hub |
+| `registry`      | String | `docker.io` | Server address of Docker registry. If not set then will default to Docker Hub |
-| `username` | String |         | Username for authenticating to the Docker registry                            |
+| `username`      | String |             | Username for authenticating to the Docker registry                            |
-| `password` | String |         | Password or personal access token for authenticating the Docker registry      |
+| `password`      | String |             | Password or personal access token for authenticating the Docker registry      |
-| `ecr`      | String | `auto`  | Specifies whether the given registry is ECR (`auto`, `true` or `false`)       |
+| `ecr`           | String | `auto`      | Specifies whether the given registry is ECR (`auto`, `true` or `false`)       |
-| `logout`   | Bool   | `true`  | Log out from the Docker registry at the end of a job                          |
+| `logout`        | Bool   | `true`      | Log out from the Docker registry at the end of a job                          |
+| `registry-auth` | YAML   |             | Raw authentication to registries, defined as YAML objects                     |
+
+> [!NOTE]
+> The `registry-auth` input is mutually exclusive with `registry`, `username`,
+> `password` and `ecr` inputs.
 
 ## Contributing
 

__tests__/aws.test.ts

@@ -10,7 +10,9 @@ describe('isECR', () => {
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', true],
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', true],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', true],
-    ['public.ecr.aws', true]
+    ['012345678901.dkr-ecr.eu-north-1.on.aws', true],
+    ['public.ecr.aws', true],
+    ['ecr-public.aws.com', true]
   ])('given registry %p', async (registry, expected) => {
     expect(aws.isECR(registry)).toEqual(expected);
   });
@@ -23,7 +25,9 @@ describe('isPubECR', () => {
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', false],
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', false],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', false],
-    ['public.ecr.aws', true]
+    ['012345678901.dkr-ecr.eu-north-1.on.aws', false],
+    ['public.ecr.aws', true],
+    ['ecr-public.aws.com', true]
   ])('given registry %p', async (registry, expected) => {
     expect(aws.isPubECR(registry)).toEqual(expected);
   });
@@ -34,6 +38,7 @@ describe('getRegion', () => {
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', 'eu-west-3'],
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', 'cn-north-1'],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', 'cn-northwest-1'],
+    ['012345678901.dkr-ecr.eu-north-1.on.aws', 'eu-north-1'],
     ['public.ecr.aws', 'us-east-1']
   ])('given registry %p', async (registry, expected) => {
     expect(aws.getRegion(registry)).toEqual(expected);
@@ -46,6 +51,7 @@ describe('getAccountIDs', () => {
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', '012345678910,023456789012', ['012345678901', '012345678910', '023456789012']],
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', '012345678901,012345678910,023456789012', ['012345678901', '012345678910', '023456789012']],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', '012345678910,023456789012', ['390948362332', '012345678910', '023456789012']],
+    ['876820548815.dkr-ecr.eu-north-1.on.aws', '012345678910,023456789012', ['876820548815', '012345678910', '023456789012']],
     ['public.ecr.aws', undefined, []]
   ])('given registry %p', async (registry, accountIDsEnv, expected) => {
     if (accountIDsEnv) {

__tests__/docker.test.ts

@@ -2,14 +2,15 @@ import {expect, jest, test} from '@jest/globals';
 import * as path from 'path';
 
 import {loginStandard, logout} from '../src/docker';
-import {Exec} from '@docker/actions-toolkit/lib/exec';
+
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 
 process.env['RUNNER_TEMP'] = path.join(__dirname, 'runner');
 
 test('loginStandard calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
-  const execSpy = jest.spyOn(Exec, 'getExecOutput').mockImplementation(async () => {
+  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -23,7 +24,13 @@ test('loginStandard calls exec', async () => {
 
   await loginStandard(registry, username, password);
 
-  expect(execSpy).toHaveBeenCalledWith(`docker`, ['login', '--password-stdin', '--username', username, registry], {
+  expect(execSpy).toHaveBeenCalledTimes(1);
+  const callfunc = execSpy.mock.calls[0];
+  if (callfunc && callfunc[1]) {
+    // we don't want to check env opt
+    callfunc[1].env = undefined;
+  }
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', username, registry], {
     input: Buffer.from(password),
     silent: true,
     ignoreReturnCode: true
@@ -33,7 +40,7 @@ test('loginStandard calls exec', async () => {
 test('logout calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
-  const execSpy = jest.spyOn(Exec, 'getExecOutput').mockImplementation(async () => {
+  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -45,7 +52,13 @@ test('logout calls exec', async () => {
 
   await logout(registry);
 
-  expect(execSpy).toHaveBeenCalledWith(`docker`, ['logout', registry], {
+  expect(execSpy).toHaveBeenCalledTimes(1);
+  const callfunc = execSpy.mock.calls[0];
+  if (callfunc && callfunc[1]) {
+    // we don't want to check env opt
+    callfunc[1].env = undefined;
+  }
+  expect(execSpy).toHaveBeenCalledWith(['logout', registry], {
     ignoreReturnCode: true
   });
 });

action.yml

@@ -18,12 +18,14 @@ inputs:
     required: false
   ecr:
     description: 'Specifies whether the given registry is ECR (auto, true or false)'
-    default: 'auto'
     required: false
   logout:
     description: 'Log out from the Docker registry at the end of a job'
     default: 'true'
     required: false
+  registry-auth:
+    description: 'Raw authentication to registries, defined as YAML objects'
+    required: false
 
 runs:
   using: 'node20'

docker-bake.hcl

@@ -1,3 +1,9 @@
+target "_common" {
+  args = {
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+}
+
 group "default" {
   targets = ["build"]
 }
@@ -11,42 +17,49 @@ group "validate" {
 }
 
 target "build" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-update"
   output = ["."]
 }
 
 target "build-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-validate"
   output = ["type=cacheonly"]
 }
 
 target "format" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "format-update"
   output = ["."]
 }
 
 target "lint" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "lint"
   output = ["type=cacheonly"]
 }
 
 target "vendor" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-update"
   output = ["."]
 }
 
 target "vendor-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "test" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]

package.json

@@ -23,28 +23,30 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@actions/core": "^1.10.1",
+    "@actions/core": "^1.11.1",
-    "@aws-sdk/client-ecr": "^3.583.0",
+    "@aws-sdk/client-ecr": "^3.890.0",
-    "@aws-sdk/client-ecr-public": "^3.583.0",
+    "@aws-sdk/client-ecr-public": "^3.890.0",
-    "@docker/actions-toolkit": "^0.24.0",
+    "@docker/actions-toolkit": "^0.63.0",
     "http-proxy-agent": "^7.0.2",
-    "https-proxy-agent": "^7.0.4"
+    "https-proxy-agent": "^7.0.6",
+    "js-yaml": "^4.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20.12.12",
+    "@types/js-yaml": "^4.0.9",
-    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@types/node": "^20.19.9",
-    "@typescript-eslint/parser": "^7.9.0",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
-    "@vercel/ncc": "^0.38.1",
+    "@typescript-eslint/parser": "^7.18.0",
-    "eslint": "^8.57.0",
+    "@vercel/ncc": "^0.38.3",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint": "^8.57.1",
-    "eslint-plugin-jest": "^28.5.0",
+    "eslint-config-prettier": "^9.1.2",
-    "eslint-plugin-prettier": "^5.1.3",
+    "eslint-plugin-jest": "^28.14.0",
+    "eslint-plugin-prettier": "^5.5.4",
     "jest": "^29.7.0",
-    "prettier": "^3.2.5",
+    "prettier": "^3.6.2",
-    "ts-jest": "^29.1.2",
+    "ts-jest": "^29.4.1",
     "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.2"
   }
 }

src/aws.ts

@@ -5,14 +5,15 @@ import {NodeHttpHandler} from '@smithy/node-http-handler';
 import {HttpProxyAgent} from 'http-proxy-agent';
 import {HttpsProxyAgent} from 'https-proxy-agent';
 
-const ecrRegistryRegex = /^(([0-9]{12})\.dkr\.ecr\.(.+)\.amazonaws\.com(.cn)?)(\/([^:]+)(:.+)?)?$/;
+const ecrRegistryRegex = /^(([0-9]{12})\.(dkr\.ecr|dkr-ecr)\.(.+)\.(on\.aws|amazonaws\.com(.cn)?))(\/([^:]+)(:.+)?)?$/;
+const ecrPublicRegistryRegex = /public\.ecr\.aws|ecr-public\.aws\.com/;
 
 export const isECR = (registry: string): boolean => {
   return ecrRegistryRegex.test(registry) || isPubECR(registry);
 };
 
 export const isPubECR = (registry: string): boolean => {
-  return registry === 'public.ecr.aws';
+  return ecrPublicRegistryRegex.test(registry);
 };
 
 export const getRegion = (registry: string): string => {
@@ -23,7 +24,7 @@ export const getRegion = (registry: string): string => {
   if (!matches) {
     return '';
   }
-  return matches[3];
+  return matches[4];
 };
 
 export const getAccountIDs = (registry: string): string[] => {

src/context.ts

@@ -6,6 +6,7 @@ export interface Inputs {
   password: string;
   ecr: string;
   logout: boolean;
+  registryAuth: string;
 }
 
 export function getInputs(): Inputs {
@@ -14,6 +15,7 @@ export function getInputs(): Inputs {
     username: core.getInput('username'),
     password: core.getInput('password'),
     ecr: core.getInput('ecr'),
-    logout: core.getBooleanInput('logout')
+    logout: core.getBooleanInput('logout'),
+    registryAuth: core.getInput('registry-auth')
   };
 }

src/docker.ts

@@ -1,6 +1,7 @@
 import * as aws from './aws';
 import * as core from '@actions/core';
-import {Exec} from '@docker/actions-toolkit/lib/exec';
+
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 
 export async function login(registry: string, username: string, password: string, ecr: string): Promise<void> {
   if (/true/i.test(ecr) || (ecr == 'auto' && aws.isECR(registry))) {
@@ -11,7 +12,7 @@ export async function login(registry: string, username: string, password: string
 }
 
 export async function logout(registry: string): Promise<void> {
-  await Exec.getExecOutput('docker', ['logout', registry], {
+  await Docker.getExecOutput(['logout', registry], {
     ignoreReturnCode: true
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
@@ -35,12 +36,8 @@ export async function loginStandard(registry: string, username: string, password
   loginArgs.push('--username', username);
   loginArgs.push(registry);
 
-  if (registry) {
+  core.info(`Logging into ${registry}...`);
-    core.info(`Logging into ${registry}...`);
+  await Docker.getExecOutput(loginArgs, {
-  } else {
-    core.info(`Logging into Docker Hub...`);
-  }
-  await Exec.getExecOutput('docker', loginArgs, {
     ignoreReturnCode: true,
     silent: true,
     input: Buffer.from(password)
@@ -57,7 +54,7 @@ export async function loginECR(registry: string, username: string, password: str
   const regDatas = await aws.getRegistriesData(registry, username, password);
   for (const regData of regDatas) {
     core.info(`Logging into ${regData.registry}...`);
-    await Exec.getExecOutput('docker', ['login', '--password-stdin', '--username', regData.username, regData.registry], {
+    await Docker.getExecOutput(['login', '--password-stdin', '--username', regData.username, regData.registry], {
       ignoreReturnCode: true,
       silent: true,
       input: Buffer.from(regData.password)

src/main.ts

@@ -1,21 +1,61 @@
+import * as yaml from 'js-yaml';
+import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
 
 import * as context from './context';
 import * as docker from './docker';
 import * as stateHelper from './state-helper';
 
+interface Auth {
+  registry: string;
+  username: string;
+  password: string;
+  ecr: string;
+}
+
 export async function main(): Promise<void> {
-  const input: context.Inputs = context.getInputs();
+  const inputs: context.Inputs = context.getInputs();
-  stateHelper.setRegistry(input.registry);
+  stateHelper.setLogout(inputs.logout);
-  stateHelper.setLogout(input.logout);
+
-  await docker.login(input.registry, input.username, input.password, input.ecr);
+  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.ecr)) {
+    throw new Error('Cannot use registry-auth with other inputs');
+  }
+
+  if (!inputs.registryAuth) {
+    stateHelper.setRegistries([inputs.registry || 'docker.io']);
+    await docker.login(inputs.registry || 'docker.io', inputs.username, inputs.password, inputs.ecr || 'auto');
+    return;
+  }
+
+  const auths = yaml.load(inputs.registryAuth) as Auth[];
+  if (auths.length == 0) {
+    throw new Error('No registry to login');
+  }
+
+  const registries: string[] = [];
+  for (const auth of auths) {
+    if (!auth.registry) {
+      registries.push('docker.io');
+    } else {
+      registries.push(auth.registry);
+    }
+  }
+  stateHelper.setRegistries(registries.filter((value, index, self) => self.indexOf(value) === index));
+
+  for (const auth of auths) {
+    await core.group(`Login to ${auth.registry || 'docker.io'}`, async () => {
+      await docker.login(auth.registry || 'docker.io', auth.username, auth.password, auth.ecr || 'auto');
+    });
+  }
 }
 
 async function post(): Promise<void> {
   if (!stateHelper.logout) {
     return;
   }
-  await docker.logout(stateHelper.registry);
+  for (const registry of stateHelper.registries.split(',')) {
+    await docker.logout(registry);
+  }
 }
 
 actionsToolkit.run(main, post);

src/state-helper.ts

@@ -1,10 +1,10 @@
 import * as core from '@actions/core';
 
-export const registry = process.env['STATE_registry'] || '';
+export const registries = process.env['STATE_registries'] || '';
 export const logout = /true/i.test(process.env['STATE_logout'] || '');
 
-export function setRegistry(registry: string) {
+export function setRegistries(registries: string[]) {
-  core.saveState('registry', registry);
+  core.saveState('registries', registries.join(','));
 }
 
 export function setLogout(logout: boolean) {